· ridom-2026-10-12-1
This policy is available in English and Greek. Ελληνικά · English
How Ridom handles data about visitors, customers, partners and contact persons.
1. Controller and contact
Rental Now Ε.Ε. operates the platform, Greek tax number 802596568, GEMI 179279406000. Contact: Olympiados 125, Thessaloniki 546 34, Greece; info@rentalnow.gr, subject “Ridom — Personal data”. This is a company contact, not a representation that a DPO has been appointed.
This policy explains which data Ridom uses, for what purposes and how you can exercise your rights.
2. Data categories
Booking/contact data includes name, email, international phone number, vehicle and store, dates and times, extras, amounts, payment status and notes you choose to provide.
Account data includes verified email, a securely derived password value rather than plain text, Google provider identifiers where used, sessions and access-security information. Partner data includes business and tax details and representative contact information.
Support/security data includes messages and requests, language and display-currency choices, acceptance records, activity logs, technical request data and transaction identifiers. Hosting and other providers may process IP addresses and device information to operate and secure their services.
With your consent, statistics about use of the public pages through Google Analytics: pages viewed, device and browser, language, approximate location (Google Analytics does not store IP addresses) and events for vehicle views, searches, payment start and booking completion. Details are in the Cookie Policy.
3. Identity documents and card data
Customers are not asked to upload identity cards or passports to Ridom. Required originals are presented at the pickup store. Do not send these documents or card data through free-text fields or chat.
Payments take place in the payment provider’s environment when the service is available. Ridom uses payment status, amounts and transaction references. It does not request or store the full card number or CVV in its own payment form.
4. Purposes and legal bases
Data necessary for requested bookings, accounts, rental communications and service is processed for a contract or requested pre-contractual steps under GDPR Article 6(1)(b).
Applicable tax, accounting and other legal obligations rely on Article 6(1)(c). Proportionate security, abuse prevention and legal-claims handling may rely on Article 6(1)(f), following a documented balancing assessment.
Google Analytics statistics rely on your consent (Article 6(1)(a) GDPR and Article 4(5) of Greek Law 3471/2006) and are activated only after you give it; you can withdraw it at any time through “Cookie settings”. Optional newsletters and any advertising technologies will use separate consent. Accepting booking terms does not consent to advertising messages or tracking. Refusing optional consent does not prevent a booking.
5. Stores and other recipients
The selected store receives the data needed to perform the particular rental and contact the customer. This does not give it access to other stores’ bookings. It provides its own privacy information for its activities, such as document checks and its rental contract.
Authorised support/technical personnel, hosting/storage providers, email and payment services, professional advisers and competent authorities may receive relevant data where there is a lawful basis. Each recipient’s legal role depends on the particular services and agreements.
Current hosting is provided through ChatGPT Sites on Cloudflare infrastructure. Brevo integration supports operational emails. Viva supports the payment integration and Google optional sign-in when the respective services are enabled. Google Analytics (Google Ireland Limited) is active only with your consent, as described in the Cookie Policy. Meta Pixel and newsletters are not active. This policy is updated before changes to providers or processing purposes.
6. International transfers
Storage and access locations depend on the hosting configuration and provider agreements. We do not represent that all data stays exclusively in Greece or the EU without verification.
Before activating a service involving transfers outside the EEA, the relevant Chapter V GDPR mechanism must be documented, such as an applicable adequacy decision or appropriate contractual safeguards and any additional measures. The final notice will identify the relevant recipients and how to obtain information about safeguards.
If you consent to statistics, Google Analytics may process data outside the EEA, including in the United States, under Google’s data processing terms and the Chapter V GDPR mechanisms that apply, such as the EU–US Data Privacy Framework or standard contractual clauses.
7. Retention
Retention depends on the purpose, applicable legal obligations and necessary legal-claims handling. A single period does not apply to every category. Specific periods and procedures for booking/accounting records, accounts, support messages, security logs and backups must be established before commercial operation.
Checkout drafts become inaccessible after two hours. Independent login sessions last up to eight hours, email verification/reset tokens up to thirty minutes, and guest-booking cookies up to thirty days. Expiry of access or a cookie does not automatically delete the booking or every associated database record.
Google Analytics data is kept for 14 months, Google Analytics cookies for up to 13 months, and your cookie choice for 12 months on your device, after which you are asked again.
Where an obligation or dispute requires retention, this is limited to relevant information and the necessary period. This edition does not promise automatic deletion mechanisms that have not been implemented and verified.
8. Rights and complaints
Contact info@rentalnow.gr to request access, correction, erasure, restriction or portability where applicable, object to processing based on legitimate interests, or withdraw consent. Withdrawal does not affect the lawfulness of earlier processing.
Requests are handled without undue delay and normally within one month. An extension of up to two further months may apply in GDPR-permitted circumstances, with notice in the first month. Proportionate identity checks may be required where reasonable doubts exist; an identity-document copy is not automatically required.
Rights are subject to statutory conditions and exceptions, such as records required by law. You may complain to the Hellenic Data Protection Authority at www.dpa.gr or another competent supervisory authority.
9. Security, automation and updates
Role-based access, protected sessions, request validation and credential-protection measures are used. Security requires ongoing management and cannot provide an absolute guarantee.
Prices may depend on dates, duration, offers, extras and store rules. The reviewed implementation did not identify automated customer credit scoring or a comparable significant decision. New processing requires review of the notice and legal basis.
Material changes will be communicated appropriately. A new purpose requiring consent cannot be activated merely by changing this policy text.